linux-kernel - [PATCH] LoongArch: BPF: Fix sign extension for 12-bit immediates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251103-1-v1-1-20e6641a57da@linux.dev>
Date: Mon, 03 Nov 2025 16:42:19 +0800
From: george <dongtai.guo@...ux.dev>
To: Alexei Starovoitov <ast@...nel.org>, 
 Daniel Borkmann <daniel@...earbox.net>, Andrii Nakryiko <andrii@...nel.org>, 
 Martin KaFai Lau <martin.lau@...ux.dev>, 
 Eduard Zingerman <eddyz87@...il.com>, Song Liu <song@...nel.org>, 
 Yonghong Song <yonghong.song@...ux.dev>, 
 John Fastabend <john.fastabend@...il.com>, KP Singh <kpsingh@...nel.org>, 
 Stanislav Fomichev <sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>, 
 Jiri Olsa <jolsa@...nel.org>, Tiezhu Yang <yangtiezhu@...ngson.cn>, 
 Hengqi Chen <hengqi.chen@...il.com>, Huacai Chen <chenhuacai@...nel.org>, 
 WANG Xuerui <kernel@...0n.name>, Youling Tang <tangyouling@...ngson.cn>
Cc: bpf@...r.kernel.org, loongarch@...ts.linux.dev, 
 linux-kernel@...r.kernel.org, George Guo <guodongtai@...inos.cn>, 
 Bing Huang <huangbing@...inos.cn>, george <dongtai.guo@...ux.dev>
Subject: [PATCH] LoongArch: BPF: Fix sign extension for 12-bit immediates

From: George Guo <guodongtai@...inos.cn>

When loading immediate values that fit within 12-bit signed range,
the move_imm function incorrectly used zero extension instead of
sign extension.

The bug was exposed when scx_simple scheduler failed with -EINVAL
in ops.init() after passing node = -1 to scx_bpf_create_dsq().
Due to incorrect sign extension, `node >= (int)nr_node_ids`
evaluated to true instead of false, causing BPF program failure.

Verified by testing with the scx_simple scheduler (located in
tools/sched_ext/). After building with `make` and running
./tools/sched_ext/build/bin/scx_simple, the scheduler now
initializes successfully with this fix.

Fix this by using sign extension (sext) instead of zero extension
for signed immediate values in move_imm.

Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support")
Reported-by: Bing Huang <huangbing@...inos.cn>
Signed-off-by: George Guo <guodongtai@...inos.cn>
---
Signed-off-by: george <dongtai.guo@...ux.dev>
---
 arch/loongarch/net/bpf_jit.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/loongarch/net/bpf_jit.h b/arch/loongarch/net/bpf_jit.h
index 5697158fd1645fdc3d83f598b00a9e20dfaa8f6d..f1398eb135b69ae61a27ed81f80b4bb0788cf0a0 100644
--- a/arch/loongarch/net/bpf_jit.h
+++ b/arch/loongarch/net/bpf_jit.h
@@ -122,7 +122,8 @@ static inline void move_imm(struct jit_ctx *ctx, enum loongarch_gpr rd, long imm
 	/* addiw rd, $zero, imm_11_0 */
 	if (is_signed_imm12(imm)) {
 		emit_insn(ctx, addiw, rd, LOONGARCH_GPR_ZERO, imm);
-		goto zext;
+		emit_sext_32(ctx, rd, is32);
+		return;
 	}
 
 	/* ori rd, $zero, imm_11_0 */

---
base-commit: 6146a0f1dfae5d37442a9ddcba012add260bceb0
change-id: 20251103-1-96faa240e8f4

Best regards,
-- 
george <dongtai.guo@...ux.dev>